Which two prerequisites must be evaluated when decrypting internet-bound traffic? (Choose two.)
Answer(s): A,C
Technical justificationA: Incomplete certificate chains – When performing TLS/SSL decryption the firewall must validate the entire chain up to a trusted root. An incomplete chain prevents the firewall from establishing trust and therefore blocks decryption of the session.C: Certificate pinning – If the server or client employs certificate pinning, the expected public-key fingerprint must match the one configured on the firewall. Mismatched pins cause decryption failure even when the chain is complete.B: RADIUS profile – RADIUS is used for authentication of users or devices, not for verifying the server’s certificate during TLS decryption; it does not affect the cryptographic validation of encrypted traffic.D: SAML certificate – SAML certificates are part of identity-provider–service-provider trust relationships and are irrelevant to the TLS handshake that protects internet-bound traffic; they do not need to be evaluated for decryption.Thus, only A and C are mandatory prerequisites for successful decryption of encrypted internet traffic.
TLS/SSL Decryption – Certificate Chain Validation: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/tls-ssl-decryption.html#certificate-validation Certificate Pinning – Configuration Guidance: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/tls-ssl-decryption.html#certificate-pinning
In which order does an NGFW process URL categories for Security policy?
Answer(s): A
Technical justificationCorrect sequence (Option A) :1. External dynamic lists – These are real-time feeds (e.g., URL, domain, or file reputation) that are fetched from Palo Alto Networks or a trusted external source and are applied before any locally defined classifications. 2. Custom URL categories – Administrators-created categories that override or supplement the predefined set; they are evaluated after the dynamic feeds so that custom logic can refine the categorization without affecting the core policy engine. 3. Predefined categories – The built-in, static classification groups (e.g., “Malware,” “Phishing”) that are used as the final fallback when no dynamic or custom match is found.This ordering ensures that the most up-to-date external intelligence is applied first, allowing administrators to layer custom policies afterward, and finally to rely on the default policy only when necessary.Why the other options are less suitableOption B places Custom URL categories before External dynamic lists. This would cause custom definitions to take precedence over the latest external threat intel, potentially missing critical updates. Option C moves Predefined categories ahead of External dynamic lists, which defeats the purpose of dynamic threat feeds by allowing static, possibly outdated categories to dominate the decision flow. Option D also reverses the proper hierarchy, positioning Predefined categories earliest and then External dynamic lists later, leading to inconsistent enforcement where static categories could inadvertently override dynamic feeds.In all three incorrect options the intended priority— dynamic → custom → predefined —is disrupted, resulting in either delayed threat mitigation or unnecessary reliance on less reliable classification sources.
PAN-OS 10.2 Administration Guide – URL Filtering section: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/url-filtering.html#GUID-7FA8B5B3-5A5E-4A6B-8F9C-5A2E0F8F7C8A Palo Alto Networks Knowledge Base – “How URL Filtering Categories Are Evaluated”: https://knowledgebase.paloaltonetworks.com/KCSArticle/KCS-000019789
What must be configured to successfully onboard a Prisma Access remote network using Strata Cloud Manager (SCM)?
Answer(s): C
Technical JustificationThe onboard-ing of a Prisma Access remote network via Strata Cloud Manager requires an IPSec termination node to be defined. This node is the endpoint that terminates the encrypted IPSec tunnels between the customer site and the Prisma Access gateway, enabling seamless traffic steering into the cloud security stack. Without explicitly provisioning an IPSec termination node, SCM has no point of attachment for the IPSec sessions, and the remote network cannot be onboarded.Option C – IPSec termination node – Directly satisfies the requirement; it is the mandatory configuration element that allows a remote network to connect to Prisma Access through SCM. The node is configured in SCM as a “Remote Network” with IPSec parameters (pre-shared key, peer ID, tunnel IP, etc.) and is then referenced when adding the remote network to a Prisma Access license.Option A – Cloud Identity Engine – Provides identity-based integration for Prisma Access but does not enable network-level onboarding of a remote site. It is unrelated to the IPSec tunnel setup required for remote network onboarding.Option B – GlobalProtect agent – Designed for endpoint protection and secure access for individual devices, not for configuring an entire remote network’s IPSec termination in SCM. It cannot substitute the required network-level termination node.Option D – Autonomous Digital Experience Manager (ADEM) – Focuses on user-experience monitoring and analytics; it does not participate in network provisioning or IPSec tunnel creation. Consequently, it cannot be used to onboard a remote network.Therefore, C is the only option that directly fulfills the technical prerequisite for onboarding a remote network in Prisma Access via SCM.
Prisma Access – Add a Remote Network : https://docs.paloaltonetworks.com/prisma/prisma-access/10-2/prisma-access-admin/en/remote-networks/add-remote-networks.html Strata Cloud Manager – Configure IPSec Termination Nodes : https://docs.paloaltonetworks.com/strata-cloud-manager/10-2/strata-cloud-manager-admin/en/remote-networks/configure-ipssec-termination-nodes.html
Which zone is available for use in Prisma Access?
Answer(s): D
JustificationIntrazone (Option D) is the only named security zone that Prisma Access exposes for configuring traffic flow.In Prisma Access the firewall can create an Intrazone to keep traffic that remains inside the same logical segment untouched by security policies, which is required for certain use-cases such as connecting to on-premises resources without traversing the public internet. Clientless VPN (Option A) is a connectivity service, not a zone type. It defines how users connect but does not represent a security zone that can be referenced in address or security policies. DMZ (Option B) is a role or placement of an interface, not a distinct zone name supported by Prisma Access. While traffic can be routed through a DMZ interface, the firewall does not provide a dedicated “DMZ” security zone for policy enforcement. Interzone (Option C) describes traffic that traverses between zones; it is a traffic flow concept, not a configurable zone object. You cannot create an “Interzone” as a security zone to attach policies or objects to.Therefore, the only valid zone that can be explicitly defined and used within Prisma Access configurations is Intrazone .
Prisma Access Administration Guide – Configuring Security Zones: https://docs.paloaltonetworks.com/prisma-access/10-2/prisma-access-admin/10-2/configure-security-zones.html Prisma Access Policy Configuration – Zone-Based Policy Overview: https://docs.paloaltonetworks.com/prisma-access/10-2/prisma-access-admin/10-2/policy-configuration.html#zone-based-policy
Which firewall attribute simplifies rule creation and automatically adapts to changes in server roles or security posture based on log events?
"Dynamic Address Groups enable automatic updates of address collections based on runtime criteria such as server role changes or security events, allowing firewall rules to adapt without manual rule edits. This flexibility reduces administrative overhead and ensures consistent enforcement as network topology evolves. Static Address Objects require manual modifications, Predefined IP address ranges are fixed and cannot react to changes, and Dynamic User Groups focus on user identity rather than network object behavior, so they do not provide the same level of automation for server-centric policy adjustments.ReferencesDynamic Address Groups: https://docs.paloaltonetworks.com/palo-alto-networks/10-2/pan-os-admin/images/dynamic-address-groups.html Address Objects Overview: https://docs.paloaltonetworks.com/palo-alto-networks/10-2/pan-os-admin/images/address-objects.html "
What is a necessary step for creation of a custom Prisma Access report on Strata Cloud Manager (SCM)?
Answer(s): B
Why B – Configure a dashboard – is the correct stepCustom Prisma Access reports are built within Strata Cloud Manager’s reporting framework. The first requirement is to create a custom dashboard that contains the widgets (charts, tables, filters) you need for the report; once the dashboard is saved, it can be exported or scheduled as a report. SCM’s UI provides a “Create Dashboard” workflow that lets you select metrics, apply scopes, and design layout – this is the explicit prerequisite documented for custom report creation.Why the other options are not appropriateA: Open a support ticket – Support is for troubleshooting issues, not a prerequisite for building a custom report. No ticket is required before initiating report design. C. Generate a PDF summary report – PDF generation is an output step after the report/dashboard is defined; it cannot be a required initial action. D. Set up Cloud Identity Engine – Cloud Identity Engine is used for identity-and-access management (IAM) integration; while it may be used alongside Prisma Access, it is not a mandatory step for creating Prisma Access reports in SCM.Therefore, configuring a dashboard (option B) is the necessary and direct prerequisite for creating a custom Prisma Access report.
Prisma Access Reporting Overview – Configuring Custom Dashboards https://docs.paloaltonetworks.com/prisma-access/10-2/prisma-access-admin/using-prisma-access-reports.html#Custom-Dashboards Strata Cloud Manager Administration Guide – Creating and Scheduling Reports https://docs.paloaltonetworks.com/strata-cloud-manager/5-0/strata-cloud-manager-admin/using-strata-cloud-manager-reports.html#Custom-Reports
Which feature of SaaS Security will allow a firewall administrator to identify unknown SaaS applications in an environment?
JustificationApp-ID Cloud Engine (Option A) – This component continuously monitors traffic and leverages cloud-based threat intelligence to detect and classify SaaS services that are not covered by the built-in App-ID signatures. It can surface unknown SaaS applications by analyzing behavioral patterns, URL-based fingerprints, and API calls, enabling a firewall admin to create policies for them. App-ID (Option D) – Although App-ID identifies known applications, it relies on static signatures. It cannot reliably surface new or undocumented SaaS services that lack signature definitions, so it is insufficient for discovering unknown SaaS apps. SaaS Data Security (Option B) – This feature focuses on protecting data in approved SaaS applications (e.g., DLP, encryption). It assumes the SaaS service is already known and does not provide discovery of new or unknown services. Cloud Identity Engine (Option C) – This engine correlates user identity with traffic for policy enforcement but does not provide application discovery capabilities; it is oriented toward user-centric control rather than SaaS identification.Therefore, the App-ID Cloud Engine is the only feature designed to uncover unknown SaaS applications in the environment.
App-ID Cloud Engine – Palo Alto Networks Documentation https://docs.paloaltonetworks.com/palo-alto-networks/10-2/palo-alto-networks-next-generation-firewall/10-2/pan-os-10-2/pan-os-10-2-administering/using-app-id-cloud-engine.htmlSaaS Security Overview – Palo Alto Networks Documentation https://docs.paloaltonetworks.com/palo-alto-networks/10-2/palo-alto-networks-next-generation-firewall/10-2/pan-os-10-2/pan-os-10-2-administering/saas-security.html
When a rule has been set up to block uploading all Portable Executable (PE) files, which type of log will display blocked files that attempt to traverse the network?
Answer(s): B – Data FilteringWhy Data Filtering is the appropriate log sourceA rule that blocks the upload of Portable Executable (PE) files operates at the file-blocking feature, which is part of the Data Filtering category in PAN-OS. When a PE file is intercepted and dropped by the file-blocking engine, the firewall generates a Data Filtering log entry that records the threat type, action (blocked), and the file’s attributes (e.g., filename, hash, size). This log is specifically designed to capture files that fail to traverse the network because they violate a data-filtering policy, such as blocking PE uploads.Why the other options are less suitableTraffic logs record packet-level activity (source/destination, ports, protocols) and do not store details about blocked file content, so they cannot explain why a PE file was stopped. URL Filtering logs pertain to HTTP/HTTPS URL access decisions and would not contain information about PE file uploads; they are unrelated to content-type filtering. Threat logs are created when a file is identified as malicious after deep-packet or sandbox inspection. If the blocking is done purely by file-blocking rules (e.g., “block all PE files”), the event is logged as Data Filtering, not as a Threat log.Structure of the justification (exam-style)Relevance – Data Filtering logs explicitly track file-blocking actions. Scope – These logs include the file name, type (PE), and the reason (“blocked upload”). Exclusion of alternatives – Traffic lacks file-type data; URL Filtering deals with web URLs only; Threat logs require malware analysis and are not used for simple rule-based blocks.
1. Palo Alto Networks Documentation – File Blocking & Data Filtering https://docs.paloaltonetworks.com/palo-alto-networks/10-2/pan-os-admin/file-blocking/pan-os-admin-file-blocking.html2. Palo Alto Networks Documentation – Understanding Logging https://docs.paloaltonetworks.com/palo-alto-networks/10-2/pan-os-admin/logging/pan-os-admin-logging.html
Share your comments for Palo Alto Networks NetSec-Pro exam with other users:
cannot evaluate yet
a laptops wireless antenna is most likely located in the bezel of the lid
good examplae to learn basic
this is useful information
looks usefull
question 81 should be c.
question 18 : response isnt a ?
plaese add questions
is dumps still valid ?
thanks for this
please upload questions
please upload the question dump for professional machinelearning
question 4 answer is c. this site shows the correct answer as b. "adopt a consumption model" is clearly a cost optimization design principle. looks like im done using this site to study!!!
number 52 answer is d
just started preparing for my exam , and this site is so much help
question 35 is incorrect, the correct answer is c, it even states so: explanation: when a vm is infected with ransomware, you should not restore the vm to the infected vm. this is because the ransomware will still be present on the vm, and it will encrypt the files again. you should also not restore the vm to any vm within the companys subscription. this is because the ransomware could spread to other vms in the subscription. the best way to restore a vm that is infected with ransomware is to restore it to a new azure vm. this will ensure that the ransomware is not present on the new vm.
i would like to take psm1 exam.
cbd and pdb are key to the database
the purchase and download process is very much streamlined. the xengine application is very nice and user-friendly but there is always room for improvement.
please upload p_sapea_2023
anyone use this? the question dont seem to follow other formats and terminology i have been studying im getting worried
good questions
hello are these questions valid for ms-102
some questions are wrongly answered but its good nonetheless
how to get system serial number using intune
is it really helpful to pass the exam
#229 in incorrect - all the customers require an annual review
kindy upload
fantastic assessment on psm 1
56 question correct answer a,b
thank you for providing the q bank
true quesstions
i can´t believe ms asks things like this, seems to be only marketing material.
hi, could you please add the last update of ns0-527
Keeping this site free takes real effort. We constantly battle automated scraping and unauthorized content copying. A quick account helps us protect the community and keep the site free.
To continue studying for your NetSec-Pro, please sign in or create a free account.